#pragma once

#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES	16
#define IMAGE_SIZEOF_SHORT_NAME             8

//#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER)        \
//    ((ULONG_PTR)(ntheader) +                                            \
//     FIELD_OFFSET( IMAGE_NT_HEADERS64, OptionalHeader ) +                 \
//     ((ntheader))->FileHeader.SizeOfOptionalHeader   \
//    ))

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
    HANDLE Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES
{
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
//
//typedef struct _IMAGE_SECTION_HEADER {
//    UCHAR		Name[IMAGE_SIZEOF_SHORT_NAME];
//    union {
//        ULONG	PhysicalAddress;
//        ULONG	VirtualSize;
//    } Misc;
//    ULONG   VirtualAddress;
//    ULONG   SizeOfRawData;
//    ULONG   PointerToRawData;
//    ULONG   PointerToRelocations;
//    ULONG   PointerToLinenumbers;
//    USHORT  NumberOfRelocations;
//    USHORT  NumberOfLinenumbers;
//    ULONG   Characteristics;
//} IMAGE_SECTION_HEADER, * PIMAGE_SECTION_HEADER;
//
//typedef struct _IMAGE_DATA_DIRECTORY {
//    ULONG		VirtualAddress;
//    ULONG		Size;
//} IMAGE_DATA_DIRECTORY, * PIMAGE_DATA_DIRECTORY;
//
//typedef struct _IMAGE_OPTIONAL_HEADER64 {
//    USHORT      Magic;
//    UCHAR       MajorLinkerVersion;
//    UCHAR       MinorLinkerVersion;
//    ULONG       SizeOfCode;
//    ULONG       SizeOfInitializedData;
//    ULONG       SizeOfUninitializedData;
//    ULONG       AddressOfEntryPoint;
//    ULONG       BaseOfCode;
//    ULONGLONG   ImageBase;
//    ULONG       SectionAlignment;
//    ULONG       FileAlignment;
//    USHORT      MajorOperatingSystemVersion;
//    USHORT      MinorOperatingSystemVersion;
//    USHORT      MajorImageVersion;
//    USHORT      MinorImageVersion;
//    USHORT      MajorSubsystemVersion;
//    USHORT      MinorSubsystemVersion;
//    ULONG       Win32VersionValue;
//    ULONG       SizeOfImage;
//    ULONG       SizeOfHeaders;
//    ULONG       CheckSum;
//    USHORT      Subsystem;
//    USHORT      DllCharacteristics;
//    ULONGLONG   SizeOfStackReserve;
//    ULONGLONG   SizeOfStackCommit;
//    ULONGLONG   SizeOfHeapReserve;
//    ULONGLONG   SizeOfHeapCommit;
//    ULONG       LoaderFlags;
//    ULONG       NumberOfRvaAndSizes;
//    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
//} IMAGE_OPTIONAL_HEADER64, * PIMAGE_OPTIONAL_HEADER64;
//
//typedef struct _IMAGE_FILE_HEADER {
//    USHORT		Machine;
//    USHORT		NumberOfSections;
//    ULONG		TimeDateStamp;
//    ULONG		PointerToSymbolTable;
//    ULONG		NumberOfSymbols;
//    USHORT		SizeOfOptionalHeader;
//    USHORT		Characteristics;
//} IMAGE_FILE_HEADER, * PIMAGE_FILE_HEADER;
//
//typedef struct _IMAGE_NT_HEADERS64 {
//    ULONG                   Signature;
//    IMAGE_FILE_HEADER       FileHeader;
//    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
//} IMAGE_NT_HEADERS64, * PIMAGE_NT_HEADERS64;

#pragma warning (disable : 4201)
typedef struct _PEB32
{
    UCHAR InheritedAddressSpace;                                            //0x0
    UCHAR ReadImageFileExecOptions;                                         //0x1
    UCHAR BeingDebugged;                                                    //0x2
    union
    {
        UCHAR BitField;                                                     //0x3
        struct
        {
            UCHAR ImageUsesLargePages : 1;                                    //0x3
            UCHAR IsProtectedProcess : 1;                                     //0x3
            UCHAR IsImageDynamicallyRelocated : 1;                            //0x3
            UCHAR SkipPatchingUser32Forwarders : 1;                           //0x3
            UCHAR IsPackagedProcess : 1;                                      //0x3
            UCHAR IsAppContainer : 1;                                         //0x3
            UCHAR IsProtectedProcessLight : 1;                                //0x3
            UCHAR IsLongPathAwareProcess : 1;                                 //0x3
        };
    };
    ULONG Mutant;                                                           //0x4
    ULONG ImageBaseAddress;                                                 //0x8
    ULONG Ldr;
}PEB32, * PPEB32;

typedef struct _PEB64
{
    UCHAR InheritedAddressSpace;                                            //0x0
    UCHAR ReadImageFileExecOptions;                                         //0x1
    UCHAR BeingDebugged;                                                    //0x2
    union
    {
        UCHAR BitField;                                                     //0x3
        struct
        {
            UCHAR ImageUsesLargePages : 1;                                    //0x3
            UCHAR IsProtectedProcess : 1;                                     //0x3
            UCHAR IsImageDynamicallyRelocated : 1;                            //0x3
            UCHAR SkipPatchingUser32Forwarders : 1;                           //0x3
            UCHAR IsPackagedProcess : 1;                                      //0x3
            UCHAR IsAppContainer : 1;                                         //0x3
            UCHAR IsProtectedProcessLight : 1;                                //0x3
            UCHAR IsLongPathAwareProcess : 1;                                 //0x3
        };
    };
    UCHAR Padding0[4];                                                      //0x4
    ULONGLONG Mutant;                                                       //0x8
    ULONGLONG ImageBaseAddress;                                             //0x10
    ULONGLONG Ldr;
}PEB64, * PPEB64;

typedef struct _PEB_LDR_DATA32
{
    ULONG Length;
    UCHAR Initialized;
    ULONG SsHandle;
    struct LIST_ENTRY32 InLoadOrderModuleList;
    struct LIST_ENTRY32 InMemoryOrderModuleList;
    struct LIST_ENTRY32 InInitializationOrderModuleList;
    ULONG EntryInProgress;
    UCHAR ShutdownInProgress;
    ULONG ShutdownThreadId;
}PEB_LDR_DATA32, * PPEB_LDR_DATA32;

//0x58 bytes (sizeof)
typedef struct _PEB_LDR_DATA
{
    ULONG Length;                                                           //0x0
    UCHAR Initialized;                                                      //0x4
    VOID* SsHandle;                                                         //0x8
    struct _LIST_ENTRY InLoadOrderModuleList;                               //0x10
    struct _LIST_ENTRY InMemoryOrderModuleList;                             //0x20
    struct _LIST_ENTRY InInitializationOrderModuleList;                     //0x30
    VOID* EntryInProgress;                                                  //0x40
    UCHAR ShutdownInProgress;                                               //0x48
    VOID* ShutdownThreadId;                                                 //0x50
}PEB_LDR_DATA, * PPEB_LDR_DATA;

typedef struct _KLDR_DATA_TABLE_ENTRY32
{
    struct LIST_ENTRY32 InLoadOrderLinks;
    ULONG ExceptionTable;
    ULONG ExceptionTableSize;
    ULONG GpValue;
    ULONG NonPagedDebugInfo;
    ULONG DllBase;
    ULONG EntryPoint;
    ULONG SizeOfImage;
    UNICODE_STRING32 FullDllName;
    UNICODE_STRING32 BaseDllName;
}KLDR_DATA_TABLE_ENTRY32, * PKLDR_DATA_TABLE_ENTRY32;

typedef struct _KLDR_DATA_TABLE_ENTRY
{
    struct _LIST_ENTRY InLoadOrderLinks;                                    //0x0
    VOID* ExceptionTable;                                                   //0x10
    ULONG ExceptionTableSize;                                               //0x18
    VOID* GpValue;                                                          //0x20
    PVOID NonPagedDebugInfo;                                                //0x28
    VOID* DllBase;                                                          //0x30
    VOID* EntryPoint;                                                       //0x38
    ULONG SizeOfImage;                                                      //0x40
    struct _UNICODE_STRING FullDllName;                                     //0x48
    struct _UNICODE_STRING BaseDllName;                                     //0x58
    ULONG Flags;                                                            //0x68
    USHORT LoadCount;                                                       //0x6c
}KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;

typedef struct _SYSTEM_THREAD_INFORMATION
{
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER CreateTime;
    ULONG WaitTime;
    PVOID StartAddress;
    CLIENT_ID ClientId;
    KPRIORITY Priority;
    LONG BasePriority;
    ULONG ContextSwitches;
    ULONG ThreadState;
    KWAIT_REASON WaitReason;
} SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER WorkingSetPrivateSize;
    ULONG HardFaultCount;
    ULONG NumberOfThreadsHighWatermark;
    ULONGLONG CycleTime;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SessionId;
    ULONG_PTR UniqueProcessKey;
    SIZE_T PeakVirtualSize;
    SIZE_T VirtualSize;
    ULONG PageFaultCount;
    SIZE_T PeakWorkingSetSize;
    SIZE_T WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
    SYSTEM_THREAD_INFORMATION Threads[1];
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;